7

In macOS High Sierra, System Prefs > Security, it says "Some system software was blocked from loading. I see a list there of three developers, and I don't recognize all of them. I'm guessing these are kext files in /L/E or /S/L/E, but how can I identify exactly which kext corresponds to each developer name? I tried grep -rn "Intel Corporation Apps" /System/Library/Extensions but that doesn't find it.enter image description here

EDIT: Adding to this question because it was never fully answered and I have now encountered another stubborn kext I can't remove in Mojave. It appears in Disabled Software but not in System Preferences security pane. enter image description here

I have grepped /L/E and /S/L/E and /Library/StagedExtensions and the only result I find is in /System/Library/Extensions/AppleKextExcludeList.kext/Contents/Info.plist

kextutil can't find it so where else can I look?:

# kextutil -b cn.com.bwstor.filesystems.enfs
Can't find extension with identifier cn.com.bwstor.filesystems.enfs
7

I figured it out. In System Information > Software > Disabled Software, it shows a list of these extensions with their bundle identifier. In my case, that was enough info to understand what the app is, but to locate the actual kext file requires more digging. Example:

grep -r "com.aladdin.kext.aksfridge" /Library/Extensions finds nothing.

grep -r "com.aladdin.kext.aksfridge" /Library/Application Support found it.

I'm not sure if there is a documented list of locations that are allowed to load kexts, but you could grep the whole hard drive for the bundle ID and that would surely find it.

  • Very nice solution. My answer has great background but doesn’t have the clarity of this answer. Well done. – bmike Jun 21 '18 at 22:25
1

I don’t have a complete answer, but there are amazing reverse engineering efforts and information sharing that might get you the final piece or a foothold enough to roll your own.

Richard Purves has done amazing work to cover “kextpocalypse” and scripting and most major MDM vendors have specific examples how to push white lists and deal with this user approved kernel extensions.

Also, be aware the behavior isn’t fully set as Apple is refining and changing how this works each release (lately) so YMMV more than usual.

Michael Lynn also is way above and beyond what I’d expect from a paid consultant putting out powerful scripts and documenting them expertly.

1

Adding to your own answer, Elliott, you can then feed this bundle ID to kextutil:

sudo kextutil -b "com.hp.kext.hp-fax-io"

Which will then tell all you ever wanted to know about it including the location of the .kext file:

file:///Library/StagedExtensions/System/Library/Extensions/hp_fax_io.kext/ is in hash exception list, allowing to load
Kext rejected due to system policy: <OSKext 0x7fe302c19730 [0x7fffa5fc38f0]> { URL = "file:///Library/StagedExtensions/System/Library/Extensions/hp_fax_io.kext/", ID = "com.hp.kext.hp-fax-io" }
Code Signing Failure: not code signed
Warnings:
    Personality CFBundleIdentifier differs from containing kext's (not necessarily a mistake, but rarely done):
        HPF00072 FAX - 2
        HPF00006 FAX - 2
[…]

Also it seems you can generally find all those extensions in that directory:

$ ls -la /Library/StagedExtensions/System/Library/Extensions
drwxr-xr-x@ - root 14 Feb  2013 hp_fax_io.kext
drwxr-xr-x@ - root 19 Aug  2013 hp_Inkjet1_io_enabler.kext
drwxr-xr-x@ - root 19 Aug  2013 hp_Inkjet9_io_enabler.kext
drwxr-xr-x@ - root 31 Okt  2014 intelhaxm.kext
drwxr-xr-x@ - root 22 Mai  2012 JMicronATA.kext
drwxr-xr-x@ - root 16 Aug  2012 Pen Tablet.kext
drwxr-xr-x@ - root 23 Jul  2016 SiLabsUSBDriver64.kext
drwxr-xr-x@ - root 23 Jul  2016 Wacom Tablet.kext
  • This is great info, but today I have two kexts listed in Disabled Software that do not appear with kextutil, it says can't find extension with that identifier. I've been grepping the entire disk for over an hour but haven't found anything. – Elliott Feb 27 at 4:39
  • 1
    Figured it out! This info is stored in a SQLite database in /private/var/db/SystemPolicyConfiguration and you need to disable SIP to modify it. – Elliott Feb 27 at 8:27
1

I had a similar experience today. I thought it might be of help for you.

"System Preferences > Security & Privacy > General" tab showed me a blocked system software. It mentioned developer 'Jongwoo Choi' which I didn't recognize. What software is this? Where is it installed? After searching the internet regarding these blocked software extensions they appear to be "kernel extensions" or .kext files.

Some more searching taught me this:

  • "System Information > Software > Extensions" shows all the extensions installed on your machine. Give it some time to load, the list might be long.
  • Now, too find the blocked extension by this developer, I ordered the list by "Obtained from". If you have an extension name, you can order by "Extension name" column. Most of the extensions are obtained from Apple so I guess these can be skipped. Also those with "Loaded" value "yes" can be skipped as well since the software is blocked from loading. I then checked each item from "Identified Developer" or "Not Signed".
  • You now should be able to find the developer or company name (that was mentioned in the "System Preferences > Security & Privacy > General" tab list of blocked software) in the details you get for each item in the window below the extensions list. Check the value for "Signed By". For me there was only one entry for that specific developer.
  • Once you found it, the value for "Location" will show you where the .kext file is located. The value for "Bundle ID" might also help to explain what this is about.

Since the kernel extensions wasn't loaded I decided to remove it.

sudo rm -rf path/to/the/kext/file

I then rebooted (not sure if it is needed). "System Preferences > Security & Privacy > General" didn't show me the blocked software message. Hooray!

However, "System Information > Software > Disabled Software" DID still show me one entry of disabled software. I recognised the entry title from the detailed information in the extension list earlier on. It is the one I just removed. For me this was "F3YNT8UCP3 - net.sf.tuntaposx.tap"

Why is it still there while I removed the .kext file? As Elliott mentioned in a comment above, it seems that there is a SQLite db that tracks information about the approval of installed software. Deleting the .kext file does not remove the entry from the database.

How to remove the entry from the db to remove it from the "System Information > Software > Disabled Software" list is described in here on Stack Overflow. The first part of the disabled software entry is the Team ID (F3YNT8UCP3 in my case). You'll need this ID to specify which entry to delete from the SQLite db.

So removing the .kext file should remove the warning in "System Preferences > Security & Privacy > General". Removing the item from the SQLite db should remove the disabled software entry in "System Information > Software > Disabled Software".

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .